PHP Exposed with php2shell Remote Code Execution Vulnerability, Tencent Cloud, OpenAI, and Google Issue Joint Announcements
PHP has been disclosed to contain remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, codenamed php2shell, through which attackers can trigger memory corruption via specially crafted multipart POST requests and gain full control of the server. Tencent Cloud issued a risk advisory on the evening of October 21 and recommended self-inspection and remediation; OpenAI said this is one of the most impactful vulnerabilities recently and will provide defenders with $1 billion in subsidized access credits through the Daybreak for Frontline Defenders program; Google said Google Cloud itself is not affected, but users running PHP on the platform may still face risks, and Gemini4Argon participated in vulnerability discovery, exploit development, attack detection, and patch verification.
Why read this
AI score 74
The high-risk PHP vulnerability has prompted simultaneous responses from Tencent Cloud, OpenAI, and Google, revealing the different roles cloud vendors and model vendors play in vulnerability response.
Topics
Body · AI translation
Article body
Tencent Cloud issued a risk advisory on the evening of October 21 regarding the PHP "php2shell" remote code execution vulnerability. According to the advisory, the Tencent Cloud Security Center has detected that PHP has been disclosed to contain remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and codenamed "php2shell." These vulnerabilities can allow an unauthenticated remote attacker to send a specially crafted multipart POST request, trigger memory corruption, and ultimately achieve remote code execution, thereby gaining full control of the server and causing other harm. To avoid business impact, Tencent Cloud Security recommends promptly conducting a security self-check; if within the affected scope, please update and remediate promptly to prevent intrusion by external attackers.
Earlier, PHP officially issued a statement saying that at approximately 15:00 UTC on Tuesday, October 20, the two CVE IDs involved in this vulnerability began circulating on online forums and social media.
OpenAI issued a statement on the critical vulnerabilities found in PHP software, noting that given the severity of the vulnerabilities and the widespread use of PHP, this is one of the most impactful vulnerabilities in recent times. OpenAI pledged to provide $1 billion in subsidized access credits through its "Daybreak for Frontline (FRO) Defenders" program to support defenders.
Google responded to the PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619. Google stated that the Google Cloud platform itself is not affected by these two vulnerabilities, but users running PHP on the platform may still be at risk. Google also stated that Gemini4Argon participated in vulnerability discovery, exploit development, attack detection, and patch verification.
(Source: Caiwen) Mid-article embedded advertisement